Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models

2026-10-04

AI Summary

This study addresses the challenge of identifying erased concepts and estimating their quantity in diffusion models without prior knowledge. To this end, it proposes Tracer, a framework that localizes target concepts without generating images or requiring foreknowledge of the erasure algorithm. Specifically, Tracer employs lightweight spectral analysis of weight footprints combined with forward probing techniques to pinpoint targets. Furthermore, it introduces a footprint coverage-guided sequential discovery mechanism and leverages confidence drops to estimate the number of erased concepts. This work overcomes the limitations of conventional attacks that rely on known targets, achieving high-precision identification and counting within seconds. Compared to membership inference and brute-force search baselines, Tracer accelerates the process by 150 to 137,000 times, representing a significant advancement in auditing concept erasure.

Abstract

Existing attacks on unlearned diffusion models assume that the erased concepts are known in advance and focus on recovering them. In practice, however, model providers may not disclose which concepts have been removed, and even with access to the original base model, an adversary may still lack a clear target to attack. In this paper, we aim to answer the following critical but overlooked questions: which concepts have been erased from the model, and how many have been erased in total? To this end, we present Tracer, a framework that rapidly and accurately identifies erased concepts and estimates their number. Tracer efficiently identifies erased concepts without generating and classifying images. By combining lightweight spectral analysis of weight footprints, it enables efficient search over large candidate vocabularies. To distinguish multiple erased concepts, we introduce a footprint coverage objective that guides sequential discovery. Tracer estimates the number of erased concepts by detecting a sharp decline in candidate confidence as the selected concepts account for the erasure footprint, without requiring labeled examples for calibration. The framework requires only lightweight linear algebra and limited forward probes, with no prior knowledge of the unlearning algorithm. Experiments across text-to-image and text-to-video backbones and diverse unlearning methods demonstrate that Tracer identifies erased concepts and estimates their number in seconds, achieving 150 to 137,000 times and 133 to 20,000 times speedups over MIA and brute-force search on image and video models, respectively, with substantially higher identification accuracy.

Problem

• Diffusion Models
• Machine Unlearning
• Concept Erasure
• Privacy Leakage

Innovation

• Machine Unlearning
• Diffusion Models
• Spectral Analysis
• Concept Erasure
• Footprint Coverage